Security audit
Security checks across malware telemetry and agentic risk
This skill is a real Xiaohongshu publishing tool, but it handles a full account cookie and can post publicly with under-scoped safeguards.
Install only if you are comfortable giving the skill a reusable Xiaohongshu session cookie and allowing it to publish after your confirmation. Use a dedicated account, review every preview carefully, avoid API mode unless the endpoint is local and fully trusted, do not send the cookie to remote services, keep the cookie out of shared repositories, and revoke or rotate the session after use.
# 初始化 session
try:
resp = requests.post(
f"{self.api_url}/init",
json={
"session_id": self.session_id,if post_time:
payload["post_time"] = post_time
resp = requests.post(
f"{self.api_url}/publish/image",
json=payload,
timeout=120python publish_xhs.py --title "标题" --desc "描述" --images cover.png card_1.png --api-mode
环境变量:
在同目录或项目根目录下创建 .env 文件，配置：
# 必需：小红书 Cookie
XHS_COOKIE=your_cookie_string_herecookie = os.getenv('XHS_COOKIE')
if not cookie:
print("❌ 错误: 未找到 XHS_COOKIE 环境变量")
print("请创建 .env 文件，添加以下内容：")
print("XHS_COOKIE=your_cookie_string_here")
print("\nCookie 获取方式：")
print("1. 在浏览器中登录小红书（https://www.xiaohongshu.com）")# 小红书笔记创作技能依赖 # Markdown 处理 markdown>=3.4.0 PyYAML>=6.0 # 浏览器自动化（渲染图片）
# Markdown 处理 markdown>=3.4.0 PyYAML>=6.0 # 浏览器自动化（渲染图片） playwright>=1.40.0
PyYAML>=6.0 # 浏览器自动化（渲染图片） playwright>=1.40.0 # 小红书发布 xhs>=0.4.0
playwright>=1.40.0 # 小红书发布 xhs>=0.4.0 # 环境变量管理 python-dotenv>=1.0.0
xhs>=0.4.0 # 环境变量管理 python-dotenv>=1.0.0 # HTTP 请求（API 模式） requests>=2.28.0
python-dotenv>=1.0.0 # HTTP 请求（API 模式） requests>=2.28.0
64/64 vendors flagged this skill as clean.
No suspicious patterns detected.